CVE-2025-39914— tracing: Silence warning when chunk allocation fails in trace_pid_write
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于chunk分配失败时未正确处理，可能导致拒绝服务攻击。
Possible ATT&CK Techniques 1 AI
T1058Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 8d6e90983ade25ec7925211ac31d9ccaf64b7edf< 7583a73c53f1d1ae7a39b130eb7190a11f0a902f |
affected |
8d6e90983ade25ec7925211ac31d9ccaf64b7edf< 1262bda871dace8c6efae25f3b6a2d34f6f06d54 |
affected | ||
8d6e90983ade25ec7925211ac31d9ccaf64b7edf< 88525accf16947ab459f8e91c27c8c53e1d612d7 |
affected | ||
8d6e90983ade25ec7925211ac31d9ccaf64b7edf< 793338906ff57d8c683f44fe48ca99d49c8782a7 |
affected | ||
8d6e90983ade25ec7925211ac31d9ccaf64b7edf< cd4453c5e983cf1fd5757e9acb915adb1e4602b6 |
affected | ||
5.16 |
affected | ||
< 5.16 |
unaffected | ||
6.1.153≤ 6.1.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-39914
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tracing: Silence warning when chunk allocation fails in trace_pid_write
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Silence warning when chunk allocation fails in trace_pid_write
Syzkaller trigger a fault injection warning:
WARNING: CPU: 1 PID: 12326 at tracepoint_add_func+0xbfc/0xeb0
Modules linked in:
CPU: 1 UID: 0 PID: 12326 Comm: syz.6.10325 Tainted: G U 6.14.0-rc5-syzkaller #0
Tainted: [U]=USER
Hardware name: Google Compute Engine/Google Compute Engine
RIP: 0010:tracepoint_add_func+0xbfc/0xeb0 kernel/tracepoint.c:294
Code: 09 fe ff 90 0f 0b 90 0f b6 74 24 43 31 ff 41 bc ea ff ff ff
RSP: 0018:ffffc9000414fb48 EFLAGS: 00010283
RAX: 00000000000012a1 RBX: ffffffff8e240ae0 RCX: ffffc90014b78000
RDX: 0000000000080000 RSI: ffffffff81bbd78b RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffffffffef
R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff81c264f0
FS: 00007f27217f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e80dff8 CR3: 00000000268f8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
tracepoint_probe_register_prio+0xc0/0x110 kernel/tracepoint.c:464
register_trace_prio_sched_switch include/trace/events/sched.h:222 [inline]
register_pid_events kernel/trace/trace_events.c:2354 [inline]
event_pid_write.isra.0+0x439/0x7a0 kernel/trace/trace_events.c:2425
vfs_write+0x24c/0x1150 fs/read_write.c:677
ksys_write+0x12b/0x250 fs/read_write.c:731
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
We can reproduce the warning by following the steps below:
1. echo 8 >> set_event_notrace_pid. Let tr->filtered_pids owns one pid
and register sched_switch tracepoint.
2. echo ' ' >> set_event_pid, and perform fault injection during chunk
allocation of trace_pid_list_alloc. Let pid_list with no pid and
assign to tr->filtered_pids.
3. echo ' ' >> set_event_pid. Let pid_list is NULL and assign to
tr->filtered_pids.
4. echo 9 >> set_event_pid, will trigger the double register
sched_switch tracepoint warning.
The reason is that syzkaller injects a fault into the chunk allocation
in trace_pid_list_alloc, causing a failure in trace_pid_list_set, which
may trigger double register of the same tracepoint. This only occurs
when the system is about to crash, but to suppress this warning, let's
add failure handling logic to trace_pid_list_set.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于chunk分配失败时未正确处理，可能导致拒绝服务攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39914
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39914
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-01 · 169 CVEs total
| CVE-2023-53517 | 9.8 CRITICAL | tipc: do not update mtu if msg_max is too small in mtu negotiation |
| CVE-2025-39919 | 8.8 HIGH | wifi: mt76: mt7996: add missing check for rx wcid entries |
| CVE-2025-39918 | 8.8 HIGH | wifi: mt76: fix linked list corruption |
| CVE-2023-53454 | 8.8 HIGH | HID: multitouch: Correct devm device reference for hidinput input_dev name |
| CVE-2022-50442 | 8.4 HIGH | fs/ntfs3: Validate buffer length while parsing index |
| CVE-2023-53493 | 8.4 HIGH | accel/qaic: tighten bounds checking in decode_message() |
| CVE-2023-53492 | 7.8 HIGH | netfilter: nf_tables: do not ignore genmask when looking up chain by id |
| CVE-2025-39924 | 7.8 HIGH | erofs: fix invalid algorithm for encoded extents |
| CVE-2023-53510 | 7.8 HIGH | scsi: ufs: core: Fix handling of lrbp->cmd |
| CVE-2025-39927 | 7.8 HIGH | ceph: fix race condition validating r_parent before applying state |
| CVE-2022-50421 | 7.8 HIGH | rpmsg: char: Avoid double destroy of default endpoint |
| CVE-2023-53506 | 7.8 HIGH | udf: Do not bother merging very long extents |
| CVE-2022-50423 | 7.8 HIGH | ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() |
| CVE-2023-53504 | 7.8 HIGH | RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF |
| CVE-2023-53495 | 7.8 HIGH | net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() |
| CVE-2023-53494 | 7.8 HIGH | crypto: xts - Handle EBUSY correctly |
| CVE-2022-50437 | 7.8 HIGH | drm/msm/hdmi: fix memory corruption with too many bridges |
| CVE-2023-53478 | 7.8 HIGH | tracing/synthetic: Fix races on freeing last_cmd |
| CVE-2023-53481 | 7.8 HIGH | ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed |
| CVE-2023-53486 | 7.8 HIGH | fs/ntfs3: Enhance the attribute size check |
Showing top 20 of 169 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2025-39914
No comments yet